- Joined
- May 25, 2007
- Messages
- 5,708
- Country Flag
- Club or Nation
TO TRF admins
Just got this message from the Admin at rugbyrefs.com and he asked me to pass it on to anyone who is running a vBulletin forum
[TEXTAREA]Looks like there was a very large attack on VB sites this morning, luckily I didn't get hit too bad, about an hours worth of clean up.
You might want to let anyone else you know that runs a VB forum/site to check the following:
1, Check no unfamiliar admins
2, Check Control panel log for no unfamiliar activity
If no & no, probably safe, if yes:
1, Ban the user & their IP (Need to get the IP from the CP Logs)
2, Delete the /install folder
3, Search templates for "biz", "derpina" & "iframe" Delete any unfamiliar.
4, Look in all your header templates at the bottom for a weird huge script, if there, delete it.
5, Check plugin manager, look at top for a script called "init_startup". Delete it.
Lastly probably pays to upgrade/Reinstall all your VB files to ensure no other scripts that have not been found are lurking.
[/TEXTAREA]
Just got this message from the Admin at rugbyrefs.com and he asked me to pass it on to anyone who is running a vBulletin forum
[TEXTAREA]Looks like there was a very large attack on VB sites this morning, luckily I didn't get hit too bad, about an hours worth of clean up.
You might want to let anyone else you know that runs a VB forum/site to check the following:
1, Check no unfamiliar admins
2, Check Control panel log for no unfamiliar activity
If no & no, probably safe, if yes:
1, Ban the user & their IP (Need to get the IP from the CP Logs)
2, Delete the /install folder
3, Search templates for "biz", "derpina" & "iframe" Delete any unfamiliar.
4, Look in all your header templates at the bottom for a weird huge script, if there, delete it.
5, Check plugin manager, look at top for a script called "init_startup". Delete it.
Lastly probably pays to upgrade/Reinstall all your VB files to ensure no other scripts that have not been found are lurking.
[/TEXTAREA]